Add basic secrets processing for GitHub integration

.github/workflows/testing.yml

@@ -75,3 +75,22 @@ jobs:
         run: |
           echo Pubber output logs:
           cat pubber.out || true
+
+  terraform:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout source
+        uses: actions/[email protected]
+      - name: Setup config
+        env:
+          TERRAFORM_CONFIG: ${{ secrets.TERRAFORM_CONFIG }}
+        if: "${{ env.TERRAFORM_CONFIG != '' }}"
+        run: |
+          base64 -d <<< "$TERRAFORM_CONFIG" > config.sh
+          cat config.sh | fgrep -v _CREDS=
+      - name: Setup terraform
+        run: (! test -f config.sh) || (source config.sh; cloud/gcp/bin/setup)
+      - name: Init terraform
+        run: (! test -f config.sh) || (source config.sh; cloud/gcp/bin/init)
+      - name: Apply terraform
+        run: (! test -f config.sh) || (source config.sh; cloud/gcp/bin/apply)

.gitignore

@@ -27,4 +27,6 @@ cloud/gcp/terraform.tfvars
 cloud/gcp/udmi-sites.tf
 cloud/gcp/main.tf
 cloud/gcp/auth/credentials.json
-cloud/gcp/.terraform*
+cloud/gcp/.terraform/
+cloud/gcp/.terraform.lock.hcl
+cloud/gcp/config.out

cloud/gcp/bin/apply

@@ -0,0 +1,7 @@
+#!/bin/bash -ex
+
+cd $(realpath $(dirname $0)/..)
+
+echo Applying terraform to project ${GCP_PROJECT_NAME}
+
+terraform apply

cloud/gcp/bin/clean

@@ -0,0 +1,5 @@
+#!/bin/bash -e
+
+echo Cleaning existing state...
+
+terraform state rm `terraform state list`

cloud/gcp/bin/init

@@ -0,0 +1,18 @@
+#!/bin/bash -ex
+
+cd $(realpath $(dirname $0)/..)
+
+echo Initializing terraform for project ${GCP_PROJECT_NAME}
+
+for file in main.tf udmi-sites.tf terraform.tfvars; do
+    if [[ ! -f $file ]]; then
+        echo Configuration file $file does not exist, did you run bin/setup?
+        false
+    fi
+done
+
+terraform init $*
+
+terraform import google_project.udmi-project ${GCP_PROJECT_NAME:?}
+
+terraform import google_storage_bucket.tf-bucket ${GCP_PROJECT_NAME}-terraform

cloud/gcp/bin/setup

@@ -0,0 +1,47 @@
+#!/bin/bash -e
+
+cd $(realpath $(dirname $0)/..)
+
+CRED_FILE=auth/credentials.json
+CONFIG_FILE=config.out
+
+if [[ -f $CRED_FILE ]]; then
+    echo Cowardly refusing to overwrite existing $CRED_FILE
+else
+    echo Writing creds to $CRED_FILE
+    base64 -d <<< "${GCP_PROJECT_CREDS:?}" > $CRED_FILE
+fi
+
+cat <<EOF > $CONFIG_FILE
+export GCP_PROJECT_NAME=${GCP_PROJECT_NAME:?}
+export GCP_PROJECT_ID=${GCP_PROJECT_ID:?}
+export GCP_PROJECT_REGION=${GCP_PROJECT_REGION:?}
+export GCP_PROJECT_GROUP=${GCP_PROJECT_GROUP:?}
+export GCP_PROJECT_CREDS="`base64 -w 0 $CRED_FILE`"
+export UDMI_SITE_NAME=${UDMI_SITE_NAME:?}
+export UDMI_SITE_REGION=${UDMI_SITE_REGION:?}
+export UDMI_SITE_GROUP=${UDMI_SITE_GROUP:?}
+EOF
+
+echo Config saved to $CONFIG_FILE
+sha256sum $CONFIG_FILE $CRED_FILE
+cat $CONFIG_FILE | fgrep -v _CREDS=
+
+echo Creating main.tf
+sed -E < main.tf.template > main.tf \
+    -e "s/@GCP_PROJECT_ID@/${GCP_PROJECT_ID}/"
+
+echo Creating udmi-sites.tf
+sed -E < udmi-sites.tf.template > udmi-sites.tf \
+    -e "s/@UDMI_SITE_NAME@/${UDMI_SITE_NAME}/" \
+    -e "s/@UDMI_SITE_REGION@/${UDMI_SITE_REGION}/" \
+    -e "s/@UDMI_SITE_GROUP@/${UDMI_SITE_GROUP}/"
+
+echo Creating terraform.tfvars
+sed -E < terraform.tfvars.template > terraform.tfvars \
+    -e "s/@GCP_PROJECT_NAME@/${GCP_PROJECT_NAME}/g" \
+    -e "s/@GCP_PROJECT_ID@/${GCP_PROJECT_ID}/" \
+    -e "s/@GCP_PROJECT_REGION@/${GCP_PROJECT_REGION}/" \
+    -e "s/@GCP_PROJECT_GROUP@/${GCP_RPOJECT_GROUP}/"
+
+echo Done with terraform setup.

cloud/gcp/variables.tf

@@ -22,6 +22,13 @@ variable "gcp_auth_file" {
   description = "GCP authentication file"
 }
 
+# GCP flaky control
+variable "gcp_flakiness_sleep" {
+  type        = number
+  description = "GCP provisioning sleep to control flakiness"
+  default     = 2
+}
+
 variable "tf-state-bucket-name" {
   type        = string
   description = "The name of the Google Storage Bucket to create to store the Terraform state"